sdk/v0.23.0
2026-03-04T21:05:41Z•411400c10c945a6527ffc3ff740b61f0085668b4d43181d38bd7ad5611d3cab0
CVE-2025-63811auth/awsauthentication-bypassdependency-updatego-cryptogolanghashicorp-vaultjose2gosecurity-fixv1.21.1v1.21.2v1.21.3vault
What happened
HashiCorp Vault release notes (v1.21.1 → v1.21.3) include one security fix and multiple dependency vulnerability mitigations. v1.21.1 fixes an auth/aws authentication bypass issue and disables UI analytics; it also updates a library to address CVE-2025-63811. v1.21.2 updates golang/x/crypto to remediate GHSA-f6x5-jh6r-wrfv, GHSA-j5w8-q4qc-rx2x and GO-2025-4134/GO-2025-4135. Users of affected Vault versions should prioritize upgrading to the patched releases.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- hashicorp_vault_releases
- Record identifier
- 411400c10c945a6527ffc3ff740b61f0085668b4d43181d38bd7ad5611d3cab0
- Enrichment time
- 2026-03-04T21:05:41Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.